Workspace Email Help

What is Phishing?

Phishing is a scheme where hackers get users to hand over sensitive information, like passwords and social security numbers. It typically involves sending spam email that looks like it's coming from a trusted source, like a bank (this is the bait), that then links to a fraudulent website impersonating the trusted source (this is the trap). The unsuspecting target then enters the information the attacker's looking for, thinking he's actually on a site he trusts.

Understanding what these attacks look like and how they work can help you spot phishing attempts, as well as give you some information about what to do if your website has been compromised to host a phishing trap.

Phishing Email (Bait)

Phishing emails impersonate trustworthy organization to steal users' credentials. In the example below, the email employs a common phishing practice: asking users to update their account information. However, when you hover over the link, it doesn't lead to the company's actual website — it leads to a phishing trap site instead:

Phishing Website (Trap)

Once users click the link in a phishing email, they're brought a fraudulent website that the attacker's impersonating. This trap site asks users to enter some kind of sensitive information, like a username or banking information. Once the user enters the information, it's sent to the hacker who uses it to compromise the user's account.

Here's an example of a convincing phishing page:

The only way to tell this isn't the actual Google® login page is to look at the browser's address bar. If you look just to the left of the first forward slash after the ones in http://, you'll notice the domain name is definitely not going to be google.com.

For example, in http://login.google.com.evilphishingsite.com/index.html, the site you're actually on is actually evilphishingsite.com.